Slashdot Mirror
IE Vulnerable to Cross-Browser Spyware Attack
An anonymous reader writes "The Register reports that Firefox can be used to infect IE on Windows. By visiting a malicious site with Firefox, a user can infect their install of Internet Explorer. Other alternative browers may expose the same vulnerability. The article quotes the CTO of ScanSafe as saying that '[j]ust switching away from IE does not give adequate projection. Now that Firefox and other alternative browsers have a toehold in the market the hacking community will get busy exploiting the vulnerabilities that exist in any complex browser.'" VitalSecurity's report points out that this vulnerability can (only) affect Windows users who use Sun's Java Runtime Environment.
"IE vulnerable to new attack" - shouldn't we find some sort of shorthand for this, since it happens so often?
I have to imagine Slashdot's bandwidth saving would be enormous.
"So on one hand, honey is an amazingly sophisticated and efficient food source. On the other hand it's bee backwash."
Yeah, I'll get right on that Timothy. Removing IE is so easy on Windows.... Not like it's built into the OS or anything.
This guy is way out there
switching away from IE does not give adequate projection
What do I need to be able to project my fears of infection adequately?
Yeah, its not like they ever offer any fixes or anything. Get real.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
This is an IE problem, not Firefox. The only way of fixing it will be uninstalling Internet Explorer and i dont think Microsoft will find that amusing at all if Mozilla went ahead and did that!
HTTP/1.1 400
1. You can't win
2. You can't break even
3. You can't get out of the game
4. No matter how hard you shake it, the last drop always rolls down your pant leg.
I'm not wrong. You haven't thought about it hard enough.
Sure they'll fix it ... by silently uninstalling Firefox using their next IE "this fixes numerous security flaws" super-updates.
and Firefox user, I would like to add my two cents:
"Lies! All Lies! Firefox cannot be hacked! Lies!".
Thank you for your support.
Sig it.
I know there's been a fair share of MS-bashing already but I just can't resist... It's pretty funny that IE is so insecure that its security holes exist in other programs :)
how about this
exploit = no user input required other than visiting website
users-doing-something-dumb = clicking yes to a security warning (that's teh best name I can come up for this) or something more brain intensive
Fly me to the moon Let me sing among those stars Let me see what spring is like On jupiter and mars
So what does it really do? Pop up more pr0n banners? I love this automated feature, actually.
Alternatively, there's the more generic ESF - (E)xploitable (S)ecurity (F)arce. This is the exact inverse of ESP, in that it is something that should have been predicted but wasn't, rather than the other way round.
For bugs from the (usual) Corporate culprits - Microsoft, Sun and IBM, I suggest that these be called ISMs.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
IE Vulnerable to Cross-Application Spyware Attack
Some website reports that KEYGEN.EXE can be used to infect IE on Windows. By running a malicious KEYGEN with Windows, a user can infect their install of Internet Explorer. Other alternative cracks may expose the same vulnerability. The article quotes the CTO of Obvious, Inc. as saying that '[j]ust switching away from IE does not give adequate projection. Now that BitTorrent and other alternative file-sharing tools have a toehold in the market the hacking community will get busy exploiting the vulnerabilities that exist in any feeble mind.'" Killmenow's report points out that this vulnerability can (only) affect Windows users who are morons.
>A little hobgoblin to pop out of their computer and whack them in the head with a mallet
Hey, that was actually a great idea for a new family of USB gadgets.
"Monday".
YAIEE!
Yet Another IE Exploit!
Electro-shock keyboard perhaps?
"Lets just change this DONT-BLAME-SENDMAIL option here...." *Zzzzz!!!* "@#*(%&@*!!!!"
"Now, to change this mail server to an open relay..." *Zzzzz!!!* "*@#$&%*$!!!!"
"Lets just install the Java Desktop system..." *Zzzzz!!!* "^#$&@%@!!!!"
"Here's a fun fact: the moon has turned to blood!" -- Newscaster, "Jesus Christ Supercop"
For the patch from Microsoft to disable all Internet capabilities of Explorer...Please, please, please!!
BUG REPORT:
When I visit a web page and it prompts me to install something, a little hobgoblin pops out of my computer and whacks me on the head with a mallet when I click yes.
After this happens, my computer slows down and I get lots of popups. I think the hobgoblin has infected me with a virus. Please disable the hobgoblin so I can install things from websites easier. And stop it from infecting me with viruses! Can't you guys program a computer right?
Funny that. The dialog box has three (count them - 1, 2, 3) exclamation icons, has a title that says "Warning - Security", explicitly states that the certificate is invalid and issued by an untrusted company, and has "No" as the default selected button. What more can be asked of Sun?
I suggest that Java make loud, obnoxious noises and shout Monty Python quotes at the user at an intolerable volume if he perchances to select "Yes", against all warnings.
Exploit, my ass.
""The security certificate was issued by a company that is not trusted."
While that read likes perfect valid english to me, knowing things that are irrelevant to my daily life and all, most people would NEVER understand that statement.
A clearer statement like "It is probable that a VIRUS is trying to install on your computer, do you want to STOP this VIRUS from installing" with a "yes" and "no" for the check box with "yes" the default.
Burn Hollywood Burn
Absolutely. Replace your force-feedback mouse with the new force-bitchslap mouse.
WHAP! No clicky!
Pound! Bang! Bin! Bash! is this a shell script or a Batman comic?
How do you defend against that?
Clearly, all software should only be installable from floppy disks, and not from over the Internet. That way, script kiddies would have to send people their exploits by snail mail, with a note attached that reads:
Still, I'm sure there'd be a few who did...
I would really rather not exploit your ass.
These aren't the sigs you're looking for.
Social engineering, I'd start writing dialog boxes that require you to click no.
"Do you not want to install?"
Never been to Tennessee have you?
Rich Cook: "Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning."
Best. Webhost. Ever. Dreamhost.
Can't your browser just read the contents of the 'evil' field from the certificate? If it's set to 'true', you don't run it!
Fred
"A fool and his freedom are soon parted"
-RMS
I just tried
/bin/su="echo you suck"
alias
and it hurt my feelings